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(57) Abstract 

The invention concerns a method for the mana^Bment of certificates stored on an identity modide. In the method, a certificate is 
received to Ihc identity module, and infbrmation obtained from said certificate is stored on the identity module. The invention makes it 
possible to Increase the number of certificates that can be stored on the identt^ module. 
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MANAG£^f£NT OF AN IDENTITY MODULE 

FIELD OF THE INVENTION 

The present invention relates to telecommuni- 
5 cation systems and devices. In particular, the inven- 
tion relates to a method for the management of an 
identity module and to an identity module which com- 
prises means for the management of its storage areas. 

The invention concerns a method for the raan- 
10 agement of certificates stored in an identity module. 
In the method, a certificate is received into the 
identity module, and information obtained from said 
certificate is stored on the identity module. 

15 BACKGROUND OF THE INVENTION 

Mobile communication networks, e.g.* GSM net- 
works (GSM, Global System for Mobile communications) 
have become very popular in recent times. Supplemen- 
tary services associated with mobile communication 

20 networks are correspondingly increasing at an ever 
faster, pace, in widely varying fields of application. 
The mobile telephone can be used, among other things, 
as a means of paying for small purchases e.g. in auto- 
matic vending machines for refreshment drinks and in 

25 automatic car wash systems. Everyday functions, such 
as payment functions, have been and will be added to 
the services available via mobile stations. Next- 
generation mobile stations will be considerably more 
advanced than their predecessors in respect of service 

30 level and data transmission capacity. 

At present, a known . practice is to use a 
digital GSM mobile station or other electronic and 
wireless terminal device having a unique identity for 
commercial transactions, such as paying a bill or re- 

35 mitting a payment by an electronic method. Patent 
specification US 5,221,838 presents a device which can 
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be used for remitting a payment. The specification de- 
scribes an electronic payment system in which a termi- 
nal device capable of wireless and/or wired data 
transfer is used as a payment terminal. The terminal 
5 device according to the specification conprises a card 
reader, a keypad and a bar code reader for data input 
and a display for visual presentation of payment in- 
formation. 

Patent specification WO 94/11849 presents a 

10 method for the utilization of telecommunication serv- 
ices and execution of payment transactions via a mo- 
bile communication system. The specification describes 
a system comprising a terminal device which communi- 
cates over a telecommunication network with a service 

15 provider's mainframe computer containing the service 
provider's payment system. The terminal device, i.e. 
mobile station used in the mobile communication net- 
work, can be provided with a subscriber identification 
unit which contains subscriber data for subscriber 

20 identification and encryption of telecommunication. 
The data can be read into the terminal device for use 
in mobile stations. As an example the specification 
mentions the GSM system, in which a sxibscriber iden- 
tity module (SIM) or a SIM card is used as a sxib- 

25 scriber identification unit. 

In a system described in specification WO 
94/11849, a mobile station communicates with a base 
station in a mobile telephone network. According to 
the specification, a connection is further established 

30 from the base station to a payment system and the 
amount to be paid as well as the data needed for sub- 
scriber identification are transmitted to the payment 
system. In a bank service as described in the specifi- 
cation, the client inserts a bank service card con- 

35 taining a SIM unit into a terminal device of a GSM 
network. In the telephone based bank service, the ter- 
minal device may be a standard GSM mobile station. By 
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the method described in the specification, a wireless 
telecommunication link can be used for implementing 
bank or cash services, such as remittance of payments 
and/or payment of bills or the like. It would also be 
5 possible to use some other terminal . device as a pay- 
ment terminal. An important point is that the terminal 
device contains or can be provided with an identity 
module having its own unique identity. It may also be 
a separate fail-safe circuit or equivalent. 

10 A digital signature, which is considered a 

general requirement in electronic payment systems, is 
used for the verification of the integrity of the ma- 
terial transmitted and the origin, of the sender. A 
digital signature is generated by encrypting a hash 

15 code computed from the material to be transmitted, us- 
ing the senders secret key. As nobody else knows the 
sender's secret key, the receiver decrypting the mate- 
rial by using the sender's public key is able to as- 
certain that the material is unchanged and that it has 

20 been generated by the sender using his secret key 
known to himself. An exanqple of an algorithm used for 
generating a digital signature is the RSA encryption 
algorithm, which is a public-and-secret-key encryption 
system and which is also used for the encryption of 

25 messages. 

To make it possible to use uniform procedures 
for reliable identification of the parties to a trans- 
action or other agreement via a telecommunication net- 
work, it is necessary to have an electronic identity 

3 0 and means for proving and ascertaining the identity. 
An electronic identity like this may also be e.g. a 
so-called network identity (Net- ID) . An electronic 
identity is based on personal data stored on a smart 
card, subscriber identity module, electronic fail-safe 

35 circuit or equivalent and the use of a key pair, a se- 
cret key and a public key, stored in a certificates 
directory maintained by a trusted third party. Using 
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such a technique, it is possible to implement, among 
other things, the identification of parties, elec- 
tronic signature, encryption and indisputability of 
transactions, in a manner providing a security level 
5 sufficient for the authorities and other service pro- 
viders . 

In the present application, 'identity' refers 
to individualizing information which is attached to a 
person or a juridical person holding an identity and 

10 which can be used to identify the person or holder. 
Likewise, 'identity* may refer to individualizing in- 
formation pertaining to an application or service and 
allowing the application or service to be identified. 

In a p\iblic key method, the user keeps a se- 

15 cret key in private use only while a public key is 
publicly available. Storing the public key as such in 
a pxiblic directory, e.g. in a x.500 or LDAP directory,, 
is not enough because someone might forge it and then 
act in the name of the rightful owner of the key. In- 

20 stead, it is necessary to have a certification service 
and a certificate, which means an evidence given by a 
trusted third party (certifier) vouching that the 
name, the personal identifier and the public key be- 
long to the same person. The certificate is generally 

25 a data aggregate consisting of the person's public 
key, name, personal identification number and other 
information, and it is signed by the certifier using 
his own secret key. 

When the receiver of a message provided with 

30 an electronic signature wants to ascertain whether the 
message is an authentic one, he must first get the 
sender's certificate, from which he will learn the 
sender's public key and name. After this, he must ver- 
ify the authenticity of the certificate. To this end, 

35 he may have to obtain additional certificates (certi- 
fication chain) which have been used to certify the 
certificate in question. 
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If the certificate is authentic, the receiver 
verifies the signature of the message by using the 
public key received in the sender's certificate. If 
the signature passes this test, then the sender is the 
5 person indicated by the certificate. The use of cer- 
tificates also necessitates the use of a freeze file 
in which discarded certificates are listed. For the 
certificates and the freeze file, directory services 
are needed. 

10 When different applications used for elec- 

tronic payment, commercial transactions, banking etc. 
are stored on the identity module, the public keys 
used in the services provided by service providers, 
such as stores, banks and other organizations provid- 

15 ing electronic services, used by these applications 
are stored at the same time. Public keys can also be 
stored later depending on the services used by the 
user of the subscriber identity module. Thus, the user 
of the identity module need not obtain a certificate 

20 for each transaction separately as the certificate is 
already on the identity module. 

The longer the certification chain created to 
produce a certificate, the more information is needed 
for the verification of the certificate. Certificates 

25 requiring a large amount of memory are a problem to 
current identity modules because the identity module 
often has a limited memory space. This is a signifi- 
cant factor limiting the use of the identity module 
for different services having different certificates. 

30 Therefore, it is an urgent objective to reduce the 
size of the certificate to allow a larger number of 
certificates to be stored on a single identity module. 
A given service application may use several certifi- 
cates when communicating on the user's behalf with the 

35 services of different service providers. Thus, the 
number of different services usable via the identity 
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module is almost exclusively limited by the size of 
the certificates. 

OBJECT OF THE INVENTION 

5 The object of the present invention is to 

eliminate the problems referred to above or at least 
to significantly alleviate them. A specific object of 
the invention is to disclose a method and an identity 
module that will make it possible to define the size 

10 of a certificate or at least to reduce it, thus allow- 
ing the number of certificates stored on a single 
identity module for use in a mobile communication en- 
vironment to be increased. 

A further object of the invention is to dis- 

15 close a method whereby a larger number of certificates 
than before can be stored on the identity module with- 
out breaking the reliability chain in a chain of cer- 
tificates. 

As for the features characteristic of the in- 
20 vention, reference is made to the appended claims. 

BRIEF DESCRIPTION OF THE INVENTION 

The main principle of operation of the solu- 
tion of the invention is to store the required cer- 

25 tificates on the identity module so that the certifi- 
cates comprised in a certification chain are removed 
from them. The identity module may be a SIM (Sub- 
scriber Identity Module) , a WIM (Wireless Identity 
Module) , a security module or a corresponding separate 

30 fail-safe circuit or a similar device or component 
used to manifest identity. The identity module may be 
a fixed or a detachable component and it must be man- 
ageable by the owner of the identity. A certificate 
received on the identity module may be saved if it can 

35 be authenticated using a card certificate stored on 
the identity module. After the certification chain has 
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been removed, the remaining public key and the associ- 
ated identity are stored in a protected storage area 
to which no access is allowed for any other applica- 
tions than the application used by the card certifi- 
5 cate. Every time when a service application in the 
identity module wamts to use a certificate stored on 
the card, it requests it from the application used by 
the card certificate from the protected storage area. 
The application used by the card certificate verifies 

10 the certificate read from the protected storage area 
and when the user trusts the issuer of the card cer- 
tificate, the user can also trust the certificate read 
from the card. 

The basic idea of the invention can be ex- 

15 pressed in a nutshell as follows. A functional unit 
has been divided into two sections A and B and a con- 
dition C. The functional unit may be the storage de- 
vice or memory of the identity module and the condi- 
tion C may be a filter or algorithm controlling the 

20 storage space. The function of section A is a ]cnown, 
open memory area and its functionalities can be influ- 
enced by known instructions, the operating system of 
the identity module. Section B may function in the 
same way as A, but the functionalities of B may only 

25 be used by a party who knows the conditions C. In the 
present case, the condition C is only known to the 
certification authority D issuing the card certificate 
and to the filter or algorithm on the card which con- 
trols the protected storage area. 

30 lichen a new certificate is to be stored on the 

identity module, the deliverer of the new certificate 
asks a certification authority D to store the certifi- 
cate on the identity module. Certification authority D 
authenticates the new certificate received from an- 

35 other certification authority E and selects from the 
certificate only those components F which necessarily 
have to be stored on the identity module. 
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Certification authority D generates his own 
certificate G from the new certificate given by E and 
from the selected components F. Appropriate informa- 
tion about certificate G needed to make it possible to 
5 read from which certificate the material F has been 
generated and to establish that the material has been 
certified by certification authority D is filed in the 
directory. 

Since only certification authority D knows 
10 the conditions regarding the manner in which F is to 
be disposed in the protected area B, F can be regarded 
as a certificate that is not public and that can be 
trusted. 

In the method of the invention for the man- 

15 agement of certificates stored on the identity module, 
the certificate is received to the identity module and 
information about said certificate is stored on said 
identity module. The identity module comprises a stor- 
age device of a data processing apparatus, said stor- 

20 age device being connected to said data processing ap- 
paratus, a card certificate stored on the storage de- 
vice, an application which uses the certificates 
stored on the identity module, and a data transfer de- 
vice connected to said data processing apparatus and 

25 provided with a communication interface for the trans- 
fer of data between an external device, such as a mo- 
bile station, and the identity module. 

According to the invention, the authenticity 
of said certificate is verified by means of said card 

30 certificate before the certificate is stored, and the 
certification chain contained in said authenticated 
certificate is filtered out from it. Before the fil- 
tering, each signature and certificate comprised in 
the certification chain can be additionally verified 

35 separately if necessary. After the filtering, the por- 
tion of the certificate remaining to be stored com- 
prises the public key contained in it and the identity 
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associated with it, but other information may be 
stored as well. In this way, the amount of storage 
space occupied by the certificate can be significantly 
reduced- When the certificate is to be used, it must 
5 first be verified by means of the card certificate. 

In an embodiment of the invention, the cer- 
tificate is rejected if a verification carried out be- 
fore its storage or use indicates that the certificate 
is unreliable. In addition, when reliable means and 

10 software are used, the certificates and the transac- 
tions inplemented using them can be trusted. However, 
we wish to point out here that, if the card certifi- 
cate is rejected, this does not necessarily mean that 
the certificate could not be used by an application on 

15 the card. Thus, if any one of the applications .identi- 
fies the certificate, then it can be stored on the 
identity module. The only difference to the filtered 
certificate is that the certificate is stored in its 
conplete form without filtering out anything from it. 

20 The identity module of the invention for the 

management of certificates comprises the above- 
mentioned components. Moreover, the identity module 
comprises means for receiving a certificate to the 
identity module and means for saving information con- 

25 tained in said certificate to a storage device. 

According to the invention, the identity mod- 
ule comprises means for verifying the authenticity of 
the certificate by means of said card certificate be- 
fore the storage of the certificate and means for fil- 

30 tering out a certification chain contained in the 
authenticated certificate from the certificate. Fur- 
thermore, the identity module comprises means for 
verifying the certificate by means of the card cer- 
tificate before its use. 

35 In an embodiment of the invention, the iden- 

tity module further comprises means for rejecting the 
certificate if a verification carried out before its 
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Storage indicates that it is unreliable, and means for 
rejecting the certificate if a verification carried 
out before its use indicates that it is unreliable. 
Moreover, the identity module may comprise means for 
5 verifying the authenticity of each signature contained 
in said certificate before the filtering. 

As compared with prior art, the present in- 
vention has the advantage that a larger number of cer- 
tificates than before can be accommodated in a limited 

10 storage space. In particular, the invention allows a 
larger number of certificates to be stored on the 
identity module or on a smart card. 

A further advantage of the invention as com- 
pared with prior art is that an update of the identity 

15 module with new certificates and applications can be 
certified by the certification method of the invention 
using a card certificate. 

LIST OF ILLUSTRATIONS 

20 In the following, the invention will be de- 

scribed by the aid of a few examples of its embodi- 
ments with reference to the attached drawing, wherein: 

Fig. 1 is a diagrammatic representation of an 
identity module according to the present invention, 

25 Pig. 2 is a diagrammatic representation of a 

method according to the present invention for storing 
a certificate on an identity module, and 

Pig. 3 is a diagrammatic representation of a 
message structure which can be used in the method of 

30 the present invention. 

Although the invention is described in the 
following exanples by referring to a subscriber iden- 
tity module, it can be applied in conjunction with any 
terminal device that uses identity modules as men- 

35 tioned above. The invention is not limited to GSM net- 
work subscriber identity modules. 
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The subscriber identity module (SIM) pre- 
sented in Fig. 1 comprises a data processing device 1, 
such as processor, microcontroller or equivalent, a 
storage device 2 connected to the data processing de- 
5 vice 1 and a data transfer device 3 connected to the 
data processing device 1. Moreover, the subscriber 
identity module SIM is provided with a communication 
interface IF for data transfer between an external de- 
vice, such as a GSM mobile station, and the subscriber 

10 identity module. 

In addition, the subscriber identity module 
presented in Fig. 1 comprises an application APP or 
contains an application APP stored on it, which appli- 
cation uses certificates stored on the subscriber 

15 identity module when communicating with services pro- 
vided by a service provider. Furthermore, the sub- 
scriber identity module is provided with means 4 for 
receiving certificates and means 5 for saving informa- 
tion obtained from the certificate to the storage de- 

20 vice 2. Moreover, the subscriber identity module com- 
prises means 6 for establishing the authenticity of a 
received certificate by using a card certificate 
(CACert) as mentioned above and means 7 for filtering 
out from an authenticated certificate a certification 

25 chain contained in it before the storage of the cer- 
tificate . 

Further, the subscriber identity module pre- 
sented in Fig. 1 comprises means 8 for authenticating 
a certificate Mcert_l stored on the subscriber iden- 

30 tity module by means of a card certificate CA_Cert be- 
fore its use. In addition, the subscriber identity 
module comprises means 9 for rejecting a certificate 
if a verification carried out before storage indicates 
that the certificate is unreliable, and means 10 for 

35 rejecting a certificate if a verification carried out 
before use indicates that the certificate is unreli- 
able. Furthermore, the siibscriber identity module com- 
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prises means 11 for authenticating the signature con- 
tained in each of said certificates before the filter- 
ing out of the signature. 

In addition, referring to the above example, 
5 Fig. 1 shows areas A and B, which, as mentioned above, 
are a non-protected storage area A and a protected 
storage area B. In the protected storage area is 
stored at least the card certificate Card_CA, which 
comprises the card certificate issuer's electronic or 

10 network identity, a short name description of the cer- 
tification authority, certificate type, e.g. RSA, a 
public encryption key, a public signing key, certifi- 
cate status, i.e. data indicating whether the certifi- 
cate is active or passive, and the number of the short 

15 message service center, said number referring to the 
issuer of the certificate. Stored in the protected 
storage area is also the user's own certificate, 
which, by way of example, may comprise the same data 
items as described above in conjunction with the card 

20 certificate except that the public encryption key and 
public signing key are replaced with a secret encryp- 
tion key and a secret signing key, respectively. The 
user's certificate is referred to in this example by 
the term MCert_l . In addition, service providers' cer- 

25 tificates, from which the certifying signatures have 
been removed to reduce the storage space occupied by 
them, may be stored in the protected storage area B. 
These certificates are referred to by the designation 
MCert_n. These certificates, too, preferably contain 

3 0 the same data items as the card certificate. 

Next, referring to Fig. 2, a preferred proce- 
dure used for receiving a certificate to the sub- 
scriber identity module will be described. First, the 
certificate is received to the subscriber identity 

35 module, block 20, The certificate has been authenti- 
cated by the issuer of the card certificate, and this 
is verified in block 21. If it is found that the 
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authenticity of the received certificate cannot be es- 
tablished even with the card certificate Card_CA 
stored on a card, then the certificate is rejected. 
The procedure could alternatively be terminated at 
5 this point, but in this exaniple we can assume that re- 
transmission of the certificate is requested, block 
25, whereupon the certificate is verified again. This 
may be repeated e.g. three times, and if even the 
third attenpt fails to prove the certificate to be 

10 authentic, then the procedure is terminated. 

If it was established in block 21 that the 
certificate is authentic, then the entire certifica- 
tion chain is filtered out from the certificate, leav- 
ing only the public key and the associated identity 

15 and possibly some additional data, block 23. After 
this, the filtered certificate is saved, block 24, to 
the protected filtered storage area B in the sub- 
scriber identity module. 

Next, referring to Fig. 3, a few preferred 

20 message structures will be described which can be used 
for the transmission of certificates according to the 
invention via an air interface to the subscriber iden- 
tity module. In this example it is assumed that the 
message type used is short message (Short Message 

25 Service, SMS) , but, as is obvious to the skilled per- 
son, other message types could be used as well. In 
this example, the certificate is transmitted using 
three short messages containing information as pre- 
sented in Fig. 3. 

30 The first message to be sent is a non- 

encrypted SMS message #1 comprising two fields. Pub- 
licKeyMod is a public verification or encryption key. 
In addition, the message contains the sequence number 
of the message, MsgNumber. The total length of this 

35 message is 1033 bits, of which the public key takes up 
1025 bits and the message number 8 bits. The second 
message. Downloaded Data in message #2, comprises five 
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fields. S3HDT describes the message type^ ReceiverlD 
the identity of the receiver, SenderlD the identity of 
the sender, where the identity may be e.g. a network 
identity code, S3AP is a pointer referring to an ap- 
5 plication which uses the certificate in question, and 
in addition the message comprises an RSA block, 
ENCDATA, which by default consists of signed and en- 
crypted data. The size of this message is 1120 bits. 

The signed and encrypted data, ENCDATA, in 

10 the message comprises five fields, the first one of 
which contains the most significant bit RSA_MSB of the 
RSA, a start field Start, the root Random of a random 
number, transmitted data SP_data and a hash code Hash' 
generated from the contents of the SP_data field. The 

15 hash code is used to verify the integrity of the in- 
formation and to ensure that the information has not 
changed during the transmission. 

Further, SP_data in message #2 comprises 
eight fields, of which the first one, NID, refers to 

20 the identity of the card certificate, ShortName refers 
to the name of the key holder, KeyUsage to the in- 
tended use of the key, KeyHash to a hash code gener- 
ated from message number 1, MCertHash to a hash code 
generated from the certificate, and a message number, 

25 MSG Number. Finally, a third message is sent, which 
further is part of the SP_data field of message 2 
ENCDATA, this field further containing a pointer to 
the key pair NID of the issuer of the card certifi- 
cate, the exponent PublicKeyE of the public key and 

30 the sequence number MsgNumber of the message. We wish 
to point out further that the above description of 
message structures is not to be taken as a limitation 
but rather as an example of the application of the in- 
vention. In the verification of the authenticity of a 

35 certificate received to the subscriber identity mod- 
ule, the above -de scribed hash codes are uaed. By means 
of these, it is possible to make sure that the re- 
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ceived certificate has been signed and authenticated 
by a given predetermined certification authority or 
certificate issuer. After it has been established that 
the certificate is authentic, the public key and the 
5 associated identity can be picked out or filtered from 
it and stored in the filtered area B. 

The invention is not restricted to the exam- 
ples of its embodiments described above; instead, many 
variations are possible within the sphere of protec- 
10 tion defined in the claims. 
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CLAIMS 

1. Method for the management of certificates 
stored on an identity module, said identity module 
comprising: 
5 - a data processing device (1), 

- a storage device (2) connected to said data 
processing device (1) 

- a card certificate (CA) stored on the storage 
device, 

10 - an application (APP) which uses the certificates 

stored on the identity module, and 

- a data transfer device (3), which is connected 
to said data processing device (1) and which is pro- 
vided with a communication interface (IF) for the 

15 transfer of information between an external device and 
the identity module, said method comprising the steps 
of: 

- receiving a certificate to the identity module, 

and 

20 - storing information obtained from said certifi- 

cate on said storage device, characterized 
in that the method further comprises the step of: 

- authenticating said certificate by means of said 
card certificate before storage of the certificate, 

25 2. Method according to claim 1, charac- 

terized in that said authenticated certificate is 
filtered to remove from it a certification chain con- 
tained in it. 

3 • Method according to claim lor2, char- 

30 acterized in that said certificate is authenti- 
cated by means of the card certificate before its use. 

4. Method according to claim 1, charac- 
terized in that, of the information contained in 
said certificate, the piiblic key and the associated 

35 identity are stored. 

5. Method according to claim 1, charac- 
terized in that said certificate is rejected if a 
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verification carried out before its storage indicates 
that it is unreliable. 

6. Method according to claim 1, charac- 
terized in that said certificate is rejected if a 

5 verification carried out before its use indicates that 
it is unreliable. 

7 . Method according to claim 1, charac- 
terized in that during the filtering: 

each signature con?)rised in said certificate is 
10 verified, 

and only signatures that the verification proves 
to be authentic are filtered out from said certifica- 
te. 

8. Identity module for the management of cer- 
15 tificates, said identity module comprising: 

- a data processing device (1) , 

- a storage device (2) connected to said data 
processing device (1) 

- a card certificate (CA) stored on the storage 
20 device, 

- an application (APP) which uses certificates, 

- a data transfer device (3) , which is connected 
to said data processing device (1) and which is pro- 
vided with a communication interface (IF) for the 

25 transfer of information between an external device and 
the identity module, said system comprising: 

- means (4) for receiving a certificate to the 
identity module, and 

- means (5) for storing information contained in 
30 said certificate on said storage device, charac- 
terized in that the subscriber identity module 
further comprises: 

- means (6) authenticating said certificate by 
means of said card certificate before storage of the 

35 certificate. 
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9. Identity module according to claim 8, 
characterized in that the identity module 
further comprises 

means (8) for filtering out from the certificate a 
5 certification chain contained in said authenticated 
certificate. 

10. Identity module according to claim 8, 
characterized in that the identity module 
further comprises means (8) for establishing the aut- 

10 henticity of said certificate by means of a card cer- 
tificate before its use. 

11. Identity module according to claim 8, 
characterized in that the identity module 
further comprises means (9) for rejecting said certi- 

15 ficate if a verification carried out before its stora- 
ge indicates that it its unreliable. 

12. Identity module according to claim 8, 
characterized in that the identity module 
further comprises means (10) for rejecting said certi- 

20 ficate if a verification carried out before its use 
indicates that it its unreliable. 

13. Identity module according to claim 8, 
characterized in that the identity module 
further comprises means (11) for verifying the authen- 

25 ticity of each signature contained in said certificate 
before the filtering. 
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